Changing the IISExpressAnonymousAuthentication setting to enabled fixes the issue (it can also be done within Visual Studio, select project, F4, set Anonymous Authentication in the properties grid to Enabled).